security.txt Checker
Checks presence and RFC 9116 compliance of security.txt files.
Guide & best practices
security.txt Check for /.well-known per RFC 9116
Validate that your security.txt is reachable and contains the key fields for a credible vulnerability disclosure process.
Typical use cases
Useful for security disclosure programs, compliance checks and giving researchers a clear reporting path.
How Balou checks security.txt
Balou fetches /.well-known/security.txt over HTTPS, checks required and optional fields per RFC 9116 and reports issues like a missing Expires.
security.txt best practices
Set at least Contact and Expires, keep Expires current (e.g. +1 year), serve over HTTPS and optionally PGP-sign the file.
Frequently asked questions
Which fields are required in security.txt?
Contact (reporting path) and Expires (expiry date) are required; optional ones include Encryption, Canonical, Policy and Preferred-Languages.
Where must the file live?
At “https://your-domain/.well-known/security.txt” and it must be reachable over HTTPS.
Why an Expires field?
It enforces regular maintenance; after expiry the file is considered stale and should be renewed (e.g. yearly).
Should I sign security.txt?
A PGP signature improves authenticity; it is optional but recommended for sensitive programs.